> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-6-level-7.md).
# Level 6 - Level 7
```
Username: natas7
Password: jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr
URL: http://natas7.natas.labs.overthewire.org
```
This the page had two links, Home and About
On checking these links found nothing.
Home Page
About Page
But both of the above mentioned pages were fetched using the URL Query Parameter `page`.
And on the index page , there was a hint in the source code of the page, which stated that the password for webuser `natas8` is in `/etc/natas_webpass/natas8`.
The URL parameter and the hint triggered me about the [LFI](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion) vulnerability. On testing whether the paramter is vulnerable to LFI by entering the password file location `/etc/natas_webpass/natas8` to the `page` URL parameter \[ ], resulted with the contents of the password file.
